lintai docs

Appearance

Rule Reference

SEC638lintai-ai-securitystablejsonwarn

MCP config: password file access

MCP configuration command accesses a sensitive system password file

Provider
lintai-ai-security
Surface
json
Scope
per_file
Tier
stable
Severity
warn
Confidence
high
Detection
structural
Remediation
message_only

Activation Model

Preset Membership

This rule is part of the builtin activation graph through these preset memberships.

basemembership
mcpmembership

Lifecycle

Stable Lifecycle Contract

State

stable_gated

Graduation rationale

Checks committed MCP launch paths for direct access to sensitive password and sudo policy files.

Deterministic signal basis

JsonSignals command-plus-args path detection over ArtifactKind::McpConfig for `/etc/shadow`, `/etc/passwd`, `/etc/sudoers`, `/etc/gshadow`, or `/etc/master.passwd`.

Malicious corpus
mcp-command-persistence-escalation
Benign corpus
mcp-safe-basic
structured evidence required remediation reviewed
Canonical note

Structural stable rule intended as a high-precision check with deterministic evidence.

Nearby Signals

Related Rules

SEC301MCP config: shell trampolineMCP configuration shells out through sh -c or bash -cjsonstable
SEC302Config: insecure HTTP endpointConfiguration contains an insecure http:// endpointjsonstable
SEC303MCP config: credential env passthroughMCP configuration passes through credential environment variablesjsonstable
SEC304Config: TLS verification disabledConfiguration disables TLS or certificate verificationjsonstable
SEC305Config: hardcoded auth materialConfiguration embeds static authentication material in a connection or auth valuejsonstable
SEC309Config: literal secrets in configConfiguration commits literal secret material in env, auth, or header valuesjsonstable

Why It Matters ​

Shared MCP configs should not launch commands that read host authentication or privilege files. Doing so can leak credential material or privilege policy to tools controlled through the repository.

What Triggers ​

SEC638 matches MCP command definitions that directly reference /etc/shadow, /etc/passwd, /etc/sudoers, /etc/gshadow, or /etc/master.passwd in command strings or arguments.

False Positives ​

System-audit tooling may intentionally inspect these files, but embedding that access in shared MCP launch config is still high-risk and generally merits review.

Remediation ​

Remove sensitive password-file access from the MCP definition. If host auditing is required, isolate it into a separately reviewed administrative workflow.